SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Distributionally equivalent and Max-Information extractions: A variational optimisation formulation. From Theorem 3.2 and 3.4, we observe that the lower and upper bounds of the objective functions of distribution equivalent and Max-Information attacks are negatives of each other. Specifically,  $-D_{\mathrm{KL}}(\operatorname*{Pr}(f_{\theta^*}^T(Q), Q) \| \operatorname*{Pr}(f_{\omega_{\mathrm{DEq}}}^E(Q), Q)) \geq \max_\omega - F(\omega, \mathcal{D}^Q)$  and  $I(\operatorname*{Pr}(f_{\theta^*}^T(Q), Q) \| \operatorname*{Pr}(f_{\omega_{\mathrm{MaxInf}}}^E(Q), Q)) \geq \max_\omega F(\omega, \mathcal{D}^Q)$ , where
$$
F (\omega , \mathcal {D} ^ {Q}) \triangleq - \mathbb {E} _ {Q} \left[ l \left(f _ {\theta^ {*}} ^ {T} (Q), f _ {\omega} ^ {E} (Q)\right) \right] + H \left(f _ {\omega} ^ {E} (Q)\right). \tag {5}
$$
Thus, following a variational approach, we aim to solve an optimisation problem on  $F(\omega, \mathcal{D}^Q)$  in an online and frequentist manner. We do not assume a parametric family of  $\mathcal{D}^Q$ . Instead, we choose a set of queries  $Q_t \in \mathbb{R}^d$  at each round  $t \in T$ . This leads to an empirical counterpart of our problem:
$$
\max  _ {\omega \in \omega , Q _ {[ 0, T ]} \in \mathbf {D} ^ {Q} _ {[ T ]}} \hat {F} (\omega , Q _ {[ 0, T ]}) \triangleq \max  _ {\omega , Q _ {[ 0, T ]}} - \frac {1}{T} \sum_ {t = 1} ^ {T} l \left(f _ {\theta^ {*}} ^ {T} \left(Q _ {t}\right), f _ {\omega} ^ {E} \left(Q _ {t}\right)\right) ] + \sum_ {t = 1} ^ {T} H \left(f _ {\omega} ^ {E} \left(Q _ {t}\right)\right). \tag {6}
$$
As we need to evaluate  $f_{\theta^*}^T$  for each  $Q_t$ , we refer  $Q_t$ 's as queries, the dataset  $\mathbf{D}^Q \subseteq \mathbb{R}^d \times \mathcal{V}$  from where they are chosen as the query dataset, and the corresponding unobserved distribution  $\mathcal{D}^Q$  as the query generating distribution. Given the optimisation problem of Equation 6, we propose an algorithm MARICH to solve it effectively.
4 Marich: A query selection algorithm for model extraction
In this section, we propose an algorithm, MARICH, to solve Equation (6) in an adaptive manner.
Algorithm design. We observe that once the queries  $Q_{[0,T]}$  are selected, the outer maximisation problem of Eq. (6) is equivalent to regularised loss minimisation. Thus, it can be solved using any standard empirical risk minimisation algorithm (e.g. Adam, SGD). Thus, to achieve query efficiency, we focus on designing a query selection algorithm that selects a batch of queries  $Q_{t}$  at round  $t \leq T$ :
$$
Q _ {t} \triangleq \underset {Q \in \mathbf {D} ^ {Q}} {\arg \max } \underbrace {- \frac {1}{t} \sum_ {i = 1} ^ {t - 1} l \left(f _ {\theta^ {*}} ^ {T} \left(Q _ {i} \cup Q\right) , f _ {\omega_ {t - 1}} ^ {E} \left(Q _ {i} \cup Q\right)\right) ]} _ {\text {M o d e l - m i s m a t c h t e r m}} + \underbrace {\sum_ {i = 1} ^ {t - 1} H \left(f _ {\omega_ {t - 1}} ^ {E} \left(Q _ {i} \cup Q\right)\right)} _ {\text {E n t r o p y t e r m}}. \tag {7}
$$
Algorithm 1 MARICH
Input: Target model:  $f^T$ , Query dataset:  $\mathbf{D}^Q$ , #Classes:  $k$
Parameter: #initial samples:  $n_0$ , Training epochs:  $E_{max}$ , #Batches of queries:  $T$ , Query budget:  $B$ , Subsampling ratios:  $\gamma_1, \gamma_2 \in (0, 1]$
Output: Extracted model  $f^{E}$
1:  $/^{*}$  Initialisation of the extracted model\*/  $\triangleright$  Phase 1
2:  $Q_0^{train} \gets n_0$  datapoints randomly chosen from  $D^Q$
3:  $Y_0^{train} \gets f^T(Q_0^{train})$ $\triangleright$  Query the target model  $f^T$  with  $Q_0^{train}$
4: for epoch  $\leftarrow 1$  to  $E_{max}$  do
5:  $f_0^{\tilde{E}} \gets \text{Train } f^E$  with  $(Q_0^{train}, Y_0^{train})$
6: end for
7:  $1 / 1^{*}$  Adaptive query selection to build the extracted model\*/ Phase 2
8: for  $t \gets 1$  to  $T$  do
9:  $Q_{t}^{entropy}\gets \mathsf{ENTROPYSA M P L I N G}(f_{t - 1}^{E},\mathbf{D}^{Q}\setminus Q_{t - 1}^{t r a i n},B)$
0:  $Q_{t}^{grad} \gets \text{ENTROPYGRADIENTSAMPLING}(f_{t-1}^{E}, Q_{t}^{\text{entropy}}, \gamma_{1}B)$
11:  $Q_{t}^{loss}\gets$  LOSSAMPLING  $(f_{t - 1}^{E},Q_{t}^{grad},Q_{t - 1}^{train},Y_{t - 1}^{train},\gamma_{1}\gamma_{2}B)$
12:  $Y_{t}^{new}\gets f^{T}(Q_{t}^{loss})$ $\triangleright$  Query the target model  $f^T$  with  $Q_{t}^{loss}$
13:  $Q_{t}^{train}\gets Q_{t - 1}^{train}\cup Q_{t}^{loss}$
14:  $Y_{t}^{train}\gets Y_{t - 1}^{train}\cup Y_{t}^{new}$
15: for epoch  $\leftarrow 1$  to  $E_{max}$  do
16:  $f_{t}^{E}\gets \mathrm{Train}f_{t - 1}^{E}$  with  $(Q_{t}^{train},Y_{t}^{train})$
17: end for
18: end for
19: return Extracted model  $f^{E} \gets f_{T}^{E}$
Here,  $f_{\omega_{t-1}}^{E}$  is the model extracted by round  $t - 1$ . Equation (7) indicates two criteria to select the queries. With the entropy term, we want to select a query that maximises the entropy of predictions for the extracted model  $f_{\omega_{t-1}}^{E}$ . This allows us to select the queries which are most informative about the mapping between the input features and the prediction space. With the model-mismatch term, Eq. (7) pushes the adversary to select queries where the target and extracted models mismatch the most. Thus, minimising the loss between target and extracted models for such a query forces them to match over the whole domain. Algorithm 1 illustrates a pseudocode of MARICH (Appendix A).
Initialisation phase. To initialise the extraction, we select a set of  $n_0$  queries, called  $Q_0^{train}$ , uniformly randomly from the query dataset  $\mathbf{D}^Q$ . We send these queries to the target model and collect corresponding predicted classes  $Y_0^{train}$  (Line 3). We use these  $n_0$  samples of input-predicted label pairs to construct a primary extracted model  $f_0^E$ .
Active sampling. As the adaptive sampling phase commences, we select  $\gamma_1\gamma_2B$  number of queries at round  $t$ . To maximise the entropy term and minimise the model-mismatch term of Eq. (7), we sequentially deploy ENTROPYSAMPLING and LOSSAMPLING. To achieve further query-efficiency, we refine the queries selected using ENTROPYSAMPLING by ENTROPYGRADIENTSAMPLING, which finds the most diverse subset from a given set of queries. Now, we describe the sampling strategies.
ENTROPYSAMPLING. First, we aim to select the set of queries which unveil most information about the mapping between the input features and the prediction space. Thus, we deploy ENTROPYSAMPLING. In ENTROPYSAMPLING, we compute the output probability vectors from  $f_{t-1}^{E}$  for all the query points in  $\mathbf{D}^Q \setminus Q_{t-1}^{train}$  and then select top  $B$  points with highest entropy:
$$
Q^{entropy}\gets \operatorname *{arg  max}_{X\subset X_{in},|X| = B}H(f^{E}(X_{in})).
$$
Thus, we select the queries  $Q_{t}^{entropy}$ , about which  $f_{t-1}^{E}$  is most confused and training on these points makes the model more informative.
ENTROPYGRADIENTSAMPLING. To be frugal about the number of queries, we refine  $Q_{t}^{entropy}$  to compute the most diverse subset of it. First, we compute the gradients of entropy of  $f_{t-1}^{E}(x)$ , i.e.  $\nabla_{x}H(f_{t-1}^{E}(x))$ , for all  $x \in Q_{t}^{entropy}$ . The gradient at point  $x$  reflects the change at  $x$  in the prediction distribution induced by  $f_{t-1}^{E}$ . We use these gradients to embed the points  $x \in Q_{t}^{entropy}$ . Now, we deploy K-means clustering to find  $k$  (= #classes) clusters with centers  $C_{in}$ . Then, we sample  $\gamma_{1}B$  points from these clusters:
$$
Q ^ {g r a d} \leftarrow \underset {X \subset Q _ {t} ^ {e n t r o p y}, | X | = \gamma_ {1} B} {\arg \min } \sum_ {x _ {i} \in X} \sum_ {x _ {j} \in C _ {i n}} \| \nabla_ {x _ {i}} H (f ^ {E} (.)) - \nabla_ {x _ {j}} H (f ^ {E} (.)) \| _ {2} ^ {2}.
$$
Selecting from  $k$  clusters ensures diversity of queries and reduces them by  $\gamma_{1}$ .
LOSSAMPLING. We select points from  $Q_{t}^{grad}$  for which the predictions of  $f_{\theta*}^{T}$  and  $f_{t-1}^{E}$  are most dissimilar. To identify these points, we compute the loss  $l(f^{T}(x), f_{t-1}^{E}(x))$  for all  $x \in Q_{t-1}^{train}$ . Then, we select top- $k$  points from  $Q_{t-1}^{train}$  with the highest loss values (Line 11), and sample a subset  $Q_{t}^{loss}$  of size  $\gamma_{1}\gamma_{2}B$  from  $Q_{t}^{grad}$  which are closest to the  $k$  points selected from  $Q_{t-1}^{train}$ . This ensures that  $f_{t-1}^{E}$  would better align with  $f^{T}$  if it trains on the points where the mismatch in predictions are higher.
At the end of Phase 2 in each round of sampling,  $Q_{t}^{loss}$  is sent to  $f^{T}$  for fetching the labels  $Y_{t}^{train}$  predicted by the target model. We use  $(Q_{t}^{loss}, Y_{t}^{loss})$  along with  $(Q_{t-1}^{train}, Y_{t-1}^{train})$  to train  $f_{t-1}^{E}$  further. Thus, MARICH performs  $n_{0} + \gamma_{1}\gamma_{2}BT$  number of queries through  $T + 1$  number of interactions with the target model  $f^{T}$  to create the final extracted model  $f_{T}^{E}$ . We experimentally demonstrate effectiveness of the model extracted by MARICH to achieve high task accuracy and to act as an informative replica of the target for extracting private information regarding private training data  $\mathbf{D}^{T}$ .
**Discussions.** Eq. (7) dictates that the active sampling strategy should try to select queries that maximise the entropy in the prediction distribution of the extracted model, while decreases the mismatch in predictions of the target and the extracted models. We further use the ENTROPYGRADIENTSAMPLING to choose a smaller but most diverse subset. As Eq. (7) does not specify any ordering between these objectives, one can argue about the sequence of using these three sampling strategies. We choose to use sampling strategies in the decreasing order of runtime complexity as the first strategy selects the queries from the whole query dataset, while the following strategies work only on the
(a) LR/EMNIST query
(b) LR/CIFAR10 query
Figure 2: Accuracy of the extracted models (mean ± std. over 10 runs) w.r.t. the target model using MARICH, and competing active sampling methods (KC, LC, MS, ES, RS). Each figure represents (a target model, a query dataset). Models extracted by MARICH are closer to the target models.
(c) ResNet/ImgNet query
(d) CNN/EMNIST query
already selected queries. We show in Appendix E that LOSSAMPLING incurs the highest runtime followed by ENTROPYGRADIENTSAMPLING, while ENTROPYSAMPLING is significantly cheaper. Remark 4.1. Previously, researchers have deployed different active sampling methods to efficiently select queries for attacks [PMG+17, CCG+20, PGS+20]. But our derivation shows that the active query selection can be grounded on the objectives of distributionally equivalent and max-information extractions. Thus, though the end result of our formulation, i.e. MARICH, is an active query selection algorithm, our framework is different and novel with respect to existing active sampling based works.
5 Experimental analysis
Now, we perform an experimental evaluation of models extracted by MARICH. Here, we discuss the experimental setup, the objectives of experiments, and experimental results. We defer the source code, extended results, parametric similarity of the extracted models, effects of model-mismatch, details of different samplings, and hyperparameters to Appendix.
Experimental setup. We implement a prototype of MARICH using Python 3.9 and PyTorch 1.12, and run on a NVIDIA GeForce RTX 3090 24 GB GPU. We perform attacks against four target models  $(f^T)$ , namely Logistic Regression (LR), CNN [LBH15], ResNet [HZRS16], BERT [DCLT18], trained on three private datasets  $(\mathbf{D}^T)$ : MNIST handwritten digits [Den12], CIFAR10  $\mathrm{[KH^{+}09]}$  and BBC News, respectively. For model extraction, we use EMNIST letters dataset [CATvS17], CIFAR10, ImageNet  $\mathrm{[DDS^{+}09]}$ , and AGNews [ZZL15], as publicly-available, mismatched query datasets  $\mathbf{D}^Q$ .
To instantiate task accuracy, we compare accuracy of the extracted models  $f_{\text{MARICH}}^E$  with the target model and models extracted by K-Center (KC) [SS18], Least-Confidence sampling (LC) [LS06], Margin sampling (MS) [BBZ07, JG19], Entropy Sampling (ES) [LG94], and Random Sampling (RS). To instantiate informativeness of the extracted models [NSH19], we compare the Membership Inference (MI), i.e. MI accuracy and MI agreements (\% and AUC), performed on the target models, and the models extracted using MARICH and competitors with same query budget. For MI, we use in-built membership attack from IBM ART [NST+18]. For brevity, we discuss Best of Competitors (BoC) against MARICH for each experiment (except Fig. 2-3) The objectives of the experiments are:
1. How do the accuracy of the model extracted using MARICH on the private dataset compare with that of the target model, and RS with same query budget?
2. How close are the prediction distributions of the model extracted using MARICH and the target model? Can MARICH produce better replica of target's prediction distribution than other active sampling methods, leading to better distributional equivalence?
3. How do the models extracted by MARICH behave under Membership Inference (MI) in comparison to the target models, and the models extracted by RS with same budget? The MI accuracy achievable by attacking a model acts as a proxy of how informative is the model.
4. How does the performance of extracted models change if Differentially Private (DP) mechanisms [DMNS06] are applied on target model either during training or while answering the queries?
Accuracy of extracted models. MARICH extracts LR models with 1,863 and 959 queries selected from EMNIST and CIFAR10, while attacking a target LR model,  $f_{\mathrm{LR}}^T$  trained on MNIST (test accuracy:  $90.82\%$ ). The models extracted by MARICH using EMNIST and CIFAR10 achieve test accuracy  $73.98\%$  and  $86.83\%$  (81.46% and 95.60% of  $f_{\mathrm{LR}}^T$ ), respectively (Figure 2a-2b). The models extracted using BoC show test accuracy  $52.60\%$  and  $79.09\%$  (57.91% and 87.08% of  $f_{\mathrm{LR}}^T$ ), i.e.
(a) LR with EMNIST
(b) ResNet with ImageNet
Figure 3: Comparing fidelity of the prediction distributions (in log scale) for different active learning algorithms. MARICH achieves  $2 - 4\times$  lower KL-divergence than others.
(a) DP-SGD to train target (b) Perturb output of query
Figure 4: Comparing test accuracy of the models extracted by MARICH against different DP mechanisms (DP-SGD and Output Perturbation) applied on the target model.
Table 1: Statistics of accuracy & membership inference (MI) for different target models, datasets & attacks. “-” means member dataset and target model is used. *BoC means Best of Competitors.
Member dataset	Target model	Query Dataset	Algorithm	Non-member dataset	#Queries	MI acc.	MI agreement	MI agreement AUC	Accuracy
MNIST	LR	-	-	EMNIST	50,000 (100%)	87.99%	-	-	90.82%
MNIST	LR	EMNIST	MARICH	EMNIST	1863 (3.73%)	84.47%	90.34%	90.89%	73.98%
MNIST	LR	EMNIST	BoC*	EMNIST	1863 (3.73%)	78.00%	80.11%	83.07%	52.60%
MNIST	LR	-	-	CIFAR10	50,000 (100%)	98.02%	-	-	90.82%
MNIST	LR	CIFAR10	MARICH	CIFAR10	959 (1.92%)	96.32%	96.89%	94.32%	81.06%
MNIST	LR	CIFAR10	BoC*	CIFAR10	959 (1.92%)	93.70%	93.67%	91.53%	77.93%
MNIST	CNN	-	-	EMNIST	50,000 (100%)	89.97%	-	-	94.83%
MNIST	CNN	EMNIST	MARICH	EMNIST	6317 (12.63%)	90.62%	87.27%	86.71%	86.83%
MNIST	CNN	EMNIST	BoC*	EMNIST	6317 (12.63%)	90.73%	87.53%	86.97%	82.51%
CIFAR10	ResNet	-	-	EMNIST	50,000 (100%)	93.61%	-	-	91.82%
CIFAR10	ResNet	ImageNet	MARICH	EMNIST	8429 (16.58%)	90.40%	93.84%	76.51%	56.11%
CIFAR10	ResNet	ImageNet	BoC*	EMNIST	8429 (16.58%)	90.08%	95.41%	72.94%	40.66%
BBCNews	BERT	-	-	AGNews	1,490 (100%)	98.61%	-	-	98.65%
BBCNews	BERT	AGNews	MARICH	AGNews	1,070 (0.83%)	94.42%	91.02%	82.62%	87.01%
BBCNews	BERT	AGNews	BoC*	AGNews	1,070 (0.83%)	89.17%	86.93%	58.64%	76.41%
significantly less than that of MARICH. MARICH attacks a ResNet,  $f_{\text{ResNet}}^T$ , trained on CIFAR10 (test accuracy: 91.82%) with 8,429 queries from ImageNet dataset, and extracts a CNN. The extracted CNN shows 56.11% (61.10% of  $f_{\text{ResNet}}^T$ ) test accuracy. But the model extracted using BoC achieves 42.05% (45.79% of  $f_{\text{ResNet}}^T$ ) accuracy (Figure 2c). We also attack a CNN with another CNN, which also reflects MARICH's improved performance (Figure 2d). To verify MARICH's effectiveness for text data, we also attack a BERT,  $f_{\text{BERT}}^T$  trained on BBCNews (test accuracy: 98.65%) with queries from the AGNews dataset. By using only 474 queries, MARICH extracts a model with 85.45% (86.64% of  $f_{\text{BERT}}^T$ ) test accuracy. The model extracted by BoC shows test accuracy 79.25% (80.36% of  $f_{\text{BERT}}^T$ ). For all the models and datasets, MARICH extracts models that achieve test accuracy closer to target models, and are more accurate than models extracted by the other algorithms.
Distributional equivalence of extracted models. One of our aims is to extract a distributionally equivalent model of the target  $f^T$  using MARICH. Thus, in Figure 3, we illustrate the KL-divergence (mean±std. over 10 runs) between the prediction distributions of the target model and the model extracted by MARICH. Due to brevity, we show two cases in the main paper: when we attack i) an LR trained on MNIST with EMNIST with an LR, and ii) a ResNet trained on CIFAR10 with ImageNet with a CNN. In all cases, we observe that the models extracted by MARICH achieve  $\sim 2 - 4 \times$  lower KL-divergence than the models extracted by all other active sampling methods. These results show that MARICH is extracts high-fidelity distributionally equivalent models than competing algorithms.
Membership inference with extracted models. In Table 1, we report accuracy, agreement in inference with target model, and agreement AUC of membership attacks performed on different target models and extracted models with different query datasets. The models extracted using MARICH demonstrate higher MI agreement with the target models than the models extracted using its competitors in most of the cases. They also achieve MI accuracy close to the target model. These results indicate that the models extracted by MARICH act as informative replicas of the target models.
Performance against privacy defenses. We test the impact of DP-based defenses deployed in the target model on the performance of MARICH. First, we train four target models on MNIST using  $DP$ -SGD  $\left[\mathrm{ACG}^{+}16\right]$  with privacy budgets  $\varepsilon = \{0.2, 0.5, 1, \infty\}$  and  $\delta = 10^{-5}$ . As illustrated in Figure 4a, accuracy of the models extracted by querying DP target models are  $\sim 2.3 - 7.4\%$  lower than the model extracted from non-private target models. Second, we apply an output perturbation method [DMNS06], where a calibrated Laplace noise is added to the responses of the target model against MARICH's queries. This ensures  $\varepsilon$ -DP for the target model. Figure 4b shows that performance of the extracted models degrade slightly for  $\varepsilon = 2, 8$ , but significantly for  $\varepsilon = 0.25$ . Thus, performance of MARICH decreases while operating against DP defenses but the degradation varies depending on the defense mechanism.
Summary of results. From the experimental results, we deduce the following conclusions.
1. Accuracy. Test accuracy (on the subsets of private datasets) of the models  $f_{\text{MARICH}}^E$  are higher than the models extracted with the competing algorithms, and are  $\sim 60 - 95\%$  of the target models (Fig. 2). This shows effectiveness of MARICH as a task accuracy extraction attack, while solving distributional equivalence and max-info extractions.
2. Distributional equivalence. We observe that the KL-divergence between the prediction distributions of the target model and  $f_{\mathrm{MARICH}}^E$  are  $\sim 2 - 4 \times$  lower than the models extracted by other active sampling algorithms. This confirms that MARICH conducts more accurate distributionally equivalent extraction than existing active sampling attacks.
3. Informative replicas: Effective membership inference. The agreement in MI achieved by attacking  $f_{\text{MARICH}}^E$  and the target model in most of the cases is higher than that of the BoC* (Table 1). Also, MI accuracy for  $f_{\text{MARICH}}^E$ 's are  $84.74\% - 96.32\%$  (Table 1). This shows that the models extracted by MARICH act as informative replicas of the target model.
4. Query-efficiency. Table 1 shows that MARICH uses only  $959 - 8,429$  queries from the public datasets, i.e. a small fraction of data used to train the target models. Thus, MARICH is significantly query efficient, as existing active learning attacks use 10k queries to commence  $\mathrm{[PGS^{+}20}$  ,Table 2].
5. Performance against defenses. Performance of MARICH decreases with the increasing level of DP applied on the target model, which is expected. But when DP-SGD is applied to train the target, the degradation is little ( $\sim 7\%$ ) even for  $\varepsilon = 0.2$ . In contrast, the degradation is higher when the output perturbation is applied with similar  $\varepsilon$  (0.25).
6. Model-obliviousness and out-of-class data. By construction, MARICH is model-oblivious and can use out-of-class public data to extract a target model. To test this flexibility of MARICH, we try and extract a ResNet trained on CIFAR10 using a different model, i.e. CNN, and out-of-class data, i.e. ImageNet. We show CNNs extracted by MARICH are more accurate, distributionally close, and also lead to higher MI accuracy that the competitors, validating flexibility of MARICH.
7. Resilience to mismatch between  $\mathbf{D}^T$  and  $\mathbf{D}^Q$ . For MARICH, the datasets  $\mathbf{D}^T$  and  $\mathbf{D}^Q$  can be significantly different. For example, we attack an MNIST-trained model with EMNIST and CIFAR10 as query datasets. MNIST contains handwritten digits, CIFAR10 contains images of aeroplanes, cats, dogs etc., and EMNIST contains handwritten letters. Thus, the data generating distributions and labels are significantly different between the private and query datasets. We also attack a CIFAR10-trained ResNet with ImageNet as  $\mathbf{D}^Q$ . CIFAR10 and ImageNet are also known to have very different labels and images. Our experiments demonstrate that Marich can handle data mismatch as well as model mismatch, which is an addendum to the existing model extraction attacks.
6 Conclusion and future directions
We investigate the design of a model extraction attack against a target ML model (classifier) trained on a private dataset and accessible through a public API. The API returns only a predicted label for a given query. We propose the notions of distributional equivalence extraction, which extends the existing notions of task accuracy and functionally equivalent model extractions. We also propose an information-theoretic notion, i.e. Max-Info model extraction. We further propose a variational relaxation of these two types of extraction attacks, and solve it using an online and adaptive query selection algorithm, MARICH. MARICH uses a publicly available query dataset different from the private dataset. We experimentally show that the models extracted by MARICH achieve  $56 - 86\%$  accuracy on the private dataset while using 959 - 8,429 queries. For both text and image data, we demonstrate that the models extracted by MARICH act as informative replicas of the target models and also yield high-fidelity replicas of the targets' prediction distributions. Typically, the functional equivalence attacks require model-specific techniques, while MARICH is model-oblivious while performing distributional equivalence attack. This poses an open question: is distributional equivalence extraction 'easier' than functional equivalence extraction, which is NP-hard  $\left[\mathrm{JCB}^{+}20\right]$ ?
P. Karmakar acknowledges supports of the programme DesCartes and the National Research Foundation, Prime Minister's Office, Singapore under its Campus for Research Excellence and Technological Enterprise (CREATE) programme. D. Basu acknowledges the Inria-Kyoto University Associate Team "RELIANT", and the ANR JCJC for the REPUBLIC project (ANR-22-CE23-0003-01) for support. We also thank Cyriaque Rousselot for the interesting initial discussions.